Beyond Compliance: Why Strong Governance Is Measured by What Organizations Do When No One Is Checking

A company can have polished manuals, meticulous board minutes, complete disclosures and an impressive governance score—and still have serious governance weaknesses beneath the surface.

That was one of the most consequential messages to emerge from “Beyond Compliance: Advancing Corporate Governance Practices for Stronger and More Resilient Organizations,” the fourth Roundtable Discussion for Publicly Listed Companies organized by the Institute of Corporate Directors (ICD) in partnership with the Good Governance Advocates and Practitioners of the Philippines (GGAPP) on September 29, 2026.

Held online via Zoom from 2:00 to 4:00 PM Philippine time, the session brought together governance practitioners, corporate leaders and professionals. Nestor “Sir Next” Layderos attended and contributed a question during the open forum. The conversation moved beyond checklists and reporting requirements into a harder question:

What does good governance look like when it is actually working?

The answer that emerged from the forum was consistent. Good governance is not proven by the existence of structures alone. It is proven by behavior, judgment, accountability, foresight and the ability of an organization to respond when pressure arrives.

In an era shaped by artificial intelligence, cybersecurity threats, climate risks, reputational volatility, stakeholder scrutiny and geopolitical uncertainty, that distinction matters.

SEC: “Resilience always begins with governance”

The forum opened with remarks from Securities and Exchange Commission Commissioner Rogelio V. Quevedo, who challenged the traditional view of corporate governance as predominantly a compliance exercise.

For years, he said, governance was often seen through regulatory requirements, timely reports and compliance checklists. Those foundations remain essential: they establish discipline, accountability and transparency. But the operating environment has changed.

Companies now confront rapid technological shifts, evolving stakeholder expectations, cybersecurity threats, geopolitical uncertainty, climate-related challenges and increasingly complex markets. His central message was succinct:

“Resilience always begins with governance.” — Commissioner Rogelio V. Quevedo, as recorded in the attendee account

Good governance, Quevedo argued, enables organizations to anticipate risks, respond to disruption, make informed decisions and create sustainable value. It strengthens investor confidence and stakeholder trust—assets that cannot simply be generated by compliance reports.

He highlighted the SEC’s emphasis on the Code of Corporate Governance for Publicly Listed Companies, sustainability reporting, internationally aligned disclosure standards and the ASEAN Corporate Governance Scorecard. The larger challenge was moving from compliance-oriented governance to governance as a strategic function. That became the central thread of the afternoon.

A panel built around the realities of governance

The discussion was moderated by Ms. Melanie T. Oteyza, identified in the event materials as Senior Vice President and Chief Audit Executive of MERALCO.

Joining her were:

• Atty. Pedro Maniego Jr., FICD — Chairperson, ICD Thought Leadership Committee; Chairman Emeritus, Energy Lawyers Association of the Philippines.
• Atty. Evelyn Sadsad Enriquez — Corporate Secretary and Compliance Officer, Philippine Seven Corporation.
• Atty. Sergio Ceniza — FVP and Chief Compliance Officer, Philippine Business Bank.
• Atty. Laurice Esteban-Tuason — identified in the supplied event poster as Senior Vice President, Corporate Compliance & Data Protection Officer, and Corporate Sustainability Officer of Converge ICT Solutions, Inc.

These are the affiliations presented for the event, rather than a claim that every title remains current. Oteyza pushed the panel toward practical questions: What changes when governance becomes real? How can a board distinguish good documentation from good governance? What does a high rating fail to reveal? How should organizations govern AI? And how do boards know whether policies work at the operational level?

When does governance truly move beyond compliance?

Oteyza opened with a foundational question: When does corporate governance move from a regulatory requirement to a genuine source of resilience, stakeholder trust and long-term value?

For Maniego, compliance is the beginning—but never the destination. He described the dual roles of conformance and performance. Conformance concerns compliance and accountability; performance concerns strategy, execution and long-term value.

“Trust is the new currency.” — Atty. Pedro Maniego Jr., as recorded in the attendee account

Boards must move beyond determining whether rules were followed. They must ask whether strategy produces measurable outcomes, whether material risks are considered alongside opportunities, and whether accountability results in actual follow-through. Governance crosses the threshold when it affects how a board thinks and decides.

For Enriquez, the shift becomes visible in everyday behavior. Compliance asks whether the organization did what the law requires. Governance asks whether it is making the right decision, for the right reasons, with the right oversight.

For Philippine Seven Corporation, operator of 7-Eleven stores, governance cannot end in the boardroom. Decisions reach employees, franchisees, suppliers and customers. The test is whether people can make sound decisions even when a rulebook does not provide a complete answer.

Ceniza reinforced the distinction. Following the law is the first step. Governance begins taking root when organizations move beyond asking lawyers and compliance officers whether each action is technically permissible and evaluate decisions through long-term stakeholder value.

What can crises teach boards about governance?

Maniego grounded the discussion in infrastructure and aviation examples. In discussing Manila Water’s experience during a supply crisis, he focused on what the board should have been seeing before the operational problem became acute.

The boardroom question: Did the board identify the dependency before it became a constraint?

Were source concentration, reserve margins, demand scenarios and intervention triggers visible at board level? A business may successfully address a symptom while leaving structural vulnerability intact. The lesson applies far beyond water.

He also cited Cebu Pacific’s experience during the pandemic, when passenger traffic collapsed and cargo operations expanded. For boards facing severe disruption, the questions become: What changed? What did we learn? Should capital still be committed?

These examples were discussed as governance lessons, not as findings of misconduct by either company. Governance is a mechanism for revisiting the assumptions behind decisions—not merely approving them. Resilience requires early identification of dependencies, alternative scenarios and strategic choices informed by risk.

How does governance become everyone’s responsibility?

Governance is often associated with the corporate secretary, compliance officer, legal department or board. Oteyza asked how organizations create a culture in which it becomes everyone’s responsibility.

Enriquez went directly to the limits of structure. Corporate secretaries and compliance officers can advise boards, monitor regulatory developments and facilitate frameworks. They cannot single-handedly create governance culture. That requires a shared mindset.

She described governance professionals as catalysts, navigators and “nudgers”—people who keep the conversation active, bring difficult issues onto agendas, remind leaders of fiduciary responsibilities and track commitments. Governance nevertheless remains a leadership and management responsibility.

The board sets the tone. Senior management translates it into policies, processes and expectations. Business units make it real through everyday choices.

A compliance culture says, “Compliance will check this.” A governance culture says, “This is part of how we do business.”

That movement from outsourced responsibility to shared responsibility is a meaningful sign that governance has become embedded.

Can a high governance score still hide serious weaknesses?

The ASEAN Corporate Governance Scorecard (ACGS) figured prominently in the discussion. Stronger ratings can signal governance quality and strengthen market confidence. But Oteyza pressed the panel: Can a company achieve a strong rating while retaining significant weaknesses?

The panel’s answer was essentially yes. Ceniza offered a memorable metaphor: a high score can open the door to stakeholder trust, but a score alone cannot keep that trust inside the room. Only substantive governance can do that.

The issue is whether policies, manuals, minutes and formal board actions work in actual corporate conduct. A company can look compliant on paper while structural problems remain unresolved.

Enriquez distinguished between showing that a mechanism exists and showing that it is effective. A committee can meet regularly without directors asking difficult questions. A Code of Conduct can exist without employees feeling safe invoking it. A whistleblowing channel can operate without employees trusting it.

Operating effectiveness, not merely design, is the real test.

Maniego added that ratings are snapshots. Strong current performance can conceal structural deficiencies. Succession plans may cover the chief executive while other critical C-suite roles remain exposed. Related-party transactions can satisfy procedures while still requiring a deeper fairness test.

Would we approve the same transaction if the counterparty were unrelated?

Cybersecurity, technology leadership and AI expertise can also become board-level blind spots. Good performance today is not proof of resilience tomorrow.

The real test: Does bad news reach the top?

Governance ratings measure structures and disclosures. They cannot fully measure human behavior. Two companies can receive similar scores yet operate very differently.

The more revealing questions are behavioral:

• Do directors speak up?
• Does management escalate bad news early?
• Are difficult issues surfaced before they become crises?
• Do independent directors have meaningful space to challenge assumptions?
• Do whistleblowing channels work?
• Does leadership want to hear what it may not want to hear?

Culture becomes decisive. A structure can look perfect while employees have learned that raising concerns is dangerous. An organization whose people can challenge decisions, surface problems and escalate risk early is better positioned to withstand disruption.

Why boards are drowning in information—and still missing risk

Boards face cybersecurity, sustainability, data privacy, geopolitical volatility and technology disruption. Esteban-Tuason offered a sharper diagnosis than simply “too much complexity”: boards can become overwhelmed because they receive disjointed data.

The solution is not to turn directors into specialists on every technical issue. It is to govern through integrated risk frameworks. Compliance, risk management, internal audit, corporate secretariat functions and business units cannot report as isolated silos.

The board needs one connected picture. Strategic priorities, integrated analytics, executive ownership and communication across the organization’s lines of defense help make complexity governable.

The panel’s call to action: What should boards do next?

As the main panel neared its close, Oteyza asked each speaker for a practical recommendation.

Enriquez urged organizations to learn from incidents, audit findings, near misses, stakeholder feedback, changing regulations and decisions that did not produce the expected outcome. Her boardroom question was: What do we need to change so that we are better prepared next time? This turns governance into continuous improvement.

Esteban-Tuason encouraged boards to make governance the primary filter for growth. Strategic decisions—where to build, what technology to use, where to invest and how to scale—should be tested against a longer horizon: do they build durable competitive advantage and protect public trust over the next 10 to 20 years?

Maniego connected conformance, performance measurement and international standards to capital-market readiness. If investors will not entrust a company with long-term capital, boards should ask whether they are genuinely governing or merely complying.

Ceniza urged boards to organize information and warning systems so that when there is smoke, directors can act before the house burns. Resilience is not simply surviving the fire. It is recognizing the smoke.

AI enters the boardroom: boon, bane—or force multiplier?

The open forum turned to artificial intelligence. The first question was straightforward: Is AI a boon or a bane to corporate governance?

Esteban-Tuason rejected the binary. AI is a force multiplier: it can strengthen data-driven oversight, analytics and decision-making. But it becomes dangerous when it replaces human judgment, ethics and board oversight.

Overreliance, weak review, cybersecurity exposure and poor data governance are risks—particularly when sensitive organizational information is uploaded without controls. The message was to keep a human in the loop.

Maniego, also an engineer, saw technology as beneficial when properly managed. Contrasting Isaac Asimov’s laws of robotics with The Terminator, he argued that AI should be managed as a tool, rather than feared as an inevitable threat. His analogy was a bright assistant that still needs guidance, mentoring and supervision.

Boards should establish a clear policy for responsible AI use. AI will not disappear because an organization refuses to use it; pretending it is not already being used may be the greater danger.

Enriquez expanded the discussion to the spectrum of AI, from generative tools to increasingly agentic systems. Deployment should be mapped to business needs. Management should define approved uses and tools, train employees, and consider cybersecurity and privacy before integration. Overreliance should not erode critical thinking.

Sir Next asks: How do you govern fast-moving functions without killing innovation?

One of the Q&A highlights came when Oteyza acknowledged a question from Nestor “Sir Next” Layderos, drawing on his experience in marketing, communications and business management.

Marketing, communications, digital and customer-experience teams increasingly make real-time decisions using AI, analytics and social platforms while managing reputational and data risks. His question went directly to that tension:

How can boards ensure that governance principles are truly embedded in fast-moving functions without becoming so restrictive that they slow down innovation and responsiveness? And what indicators should boards look at to know that governance is actually working at the operational level?

Oteyza reframed this as the balance between moving quickly—potentially being first to market—and applying controls for responsible AI and digital technology use.

Esteban-Tuason offered two practical actions: establish operational guardrails, objectives and decision thresholds; and build expertise. Organizations cannot govern tools they do not understand. Internal upskilling and specialist support can guide implementation.

Maniego returned to fairness, accountability and transparency. Technology changes rapidly; governance principles remain. Boards need technology-savvy expertise at board and operational levels. Measurement should cascade from strategy into operational performance. He cited the Balanced Scorecard and team-based improvement approaches to avoid concentrating governance only at the top.

Enriquez addressed shadow AI: employees may already be using ChatGPT and other tools before management approves them. Organizations cannot govern by pretending adoption has not happened.

Her starting point was to face reality: understand current use, guide employees, identify approved tools, escalate relevant risks, and align policies before unmanaged behavior causes cybersecurity, privacy or reputational damage.

For marketing, communications and digital leaders, this was an immediately applicable discussion. The answer was to design governance for speed—with clarity, expertise and accountability.

Can banning AI actually work?

Ceniza drew an analogy from education. Schools debate whether AI enables cheating or expands capability; boardrooms can face the same disagreement.

His recommendation was to bring competing perspectives into the same room, build understanding, study benefits and risks, and decide how technology can be adopted responsibly. The goal is informed use, rather than blind adoption or rejection.

Compliance on paper versus governance in substance

Another question asked for examples of technically compliant companies that fall short in substance. Rather than naming corporations, the panel described a regulatory pattern: excellent manuals and policies alongside the same exceptions year after year.

Repeated findings can indicate that governance is not resolving root causes. Recurring exceptions are evidence. If the problem keeps returning, an organization may be documenting governance better than it practices it.

How transparent should companies be about board compensation?

The forum addressed ACGS treatment of director and executive compensation disclosure. Philippine companies may prefer aggregate reporting because of privacy or security concerns; the panel noted that many firms use that approach.

Maniego said international best practice favors greater individual disclosure, and companies pursuing the highest score for the relevant criteria may need to move toward that benchmark.

This illustrated a broader tension: global transparency expectations do not always fit neatly into local practice. Boards must understand both the framework and its underlying principle. This account summarizes the discussion, rather than offering a definitive interpretation of current scoring rules or disclosure obligations.

If directors do not understand AI, who governs it?

A participant asked how boards can balance aggressive digital innovation, ethical guardrails and data privacy when directors may not fully understand the technology.

Esteban-Tuason’s answer was structural: align board composition and expertise with company strategy, and continually learn. Technology literacy cannot be treated as optional when the strategy depends on technology. Continuous board education forms part of governance readiness.

Whistleblowing: silence is not always good news

How can boards reduce fear of retaliation and make whistleblowing effective? Ceniza emphasized a clear policy explaining how reports are received, who handles them and how concerns are addressed. But employees must also trust the mechanism.

Very few reports do not necessarily mean very few problems. Silence may reflect fear. Psychological safety, anti-retaliation protections, communication and visible management support matter.

A whistleblowing channel no one trusts cannot deliver the protection its policy promises.

Resilience beyond what the law requires

Asked what boards could adopt immediately—even if not legally required—Maniego shifted to his sustainability perspective. He recommended energy and water resilience through rooftop solar, energy efficiency, conservation, water storage or harvesting systems.

These measures were positioned as business resilience. Lower consumption can support competitiveness; water conservation can reduce vulnerability. Sustainability becomes part of operational risk management.

What does independence really mean in the boardroom?

The final exchanges considered independent oversight where founders or controlling families retain the chairmanship. Independence cannot be reduced to titles alone.

The question is whether directors exercise objective judgment independent of management pressure, challenge decisions when necessary, and preserve meaningful minority and independent representation. Once again, the test is whether the structure works.

From structure to culture, ratings to substance, compliance to resilience

Oteyza’s closing synthesis brought the conversation together. Governance must influence decisions, be shared throughout the organization, and pair ratings and disclosures with credible oversight. Boards must remain forward-looking as AI, cybersecurity, sustainability and data privacy reshape risk.

From structure to culture. From ratings to substance. From present compliance to future resilience.

That is a useful lens for the entire discussion: good governance becomes visible when an organization is under pressure.

What readers—and boards—can take away

The roundtable challenged the idea that governance is primarily about proving compliance. Its more demanding test includes the quality of decisions when the rulebook is incomplete; whether uncomfortable information reaches the board; whether dependencies are recognized before crises; whether people trust reporting channels; and whether AI strengthens judgment without replacing it.

It includes expertise to understand technologies driving strategy, high scores backed by real practices, and learning from near misses rather than merely recording them.

Stakeholders must be able to trust the organization after the awards, disclosures and scorecards have done their job. Resilience means seeing risk earlier, confronting it honestly and acting before the smoke becomes fire.

The Sir Next takeaway: Better boards, better stewardship

For me, this discussion is a reminder that improving a board is ultimately about improving how an organization serves.

Through my years of participation in boards and leadership responsibilities, I have learned that experience alone is not enough. We need to keep learning, strengthening our judgment and evolving our systems so that we can serve people, stakeholders and the planet more responsibly.

Hindi sapat na gumagana ang board sa papel. Dapat nakikita ang halaga nito sa direksiyon, desisyon, accountability at pangangalaga sa mga taong naaapektuhan ng organisasyon.

Profitability and sustainability both require disciplined stewardship. A productive organization needs leaders who understand risk, welcome difficult questions, support innovation responsibly and consider the long-term consequences of growth.

The challenge I take from this forum is practical: harness what we know, remain teachable, and build boards that help organizations become stronger—not only in performance, but also in purpose and public trust.

About the Institute of Corporate Directors

The Institute of Corporate Directors (Philippines) is a non-stock, not-for-profit national association of corporate directors and other governance stakeholders. It supports stronger corporate governance through director learning, board services, assessments and professional development. Its work emphasizes governance and stewardship for the benefit of society.

Explore ICD’s official website and programs and events. For inquiries, email communications@icd.ph or call +63 915 848 7558.

ICD Facebook link supplied by Sir Next · Open the ICD community invitation in Spaces. The invitation opens the app/community joining flow; membership access may require sign-in.

Sources and editorial context

This is an independent NextEVENTS account by Nestor “Sir Next” Layderos, who attended the session. Discussion summaries, quotations, examples and the Q&A are drawn from the attendee account supplied for this article; they have not been independently checked against an official recording. Event posters are reproduced from the supplied materials. They document the event, rather than an endorsement of this article by ICD, GGAPP or the speakers.

• ICD — official Beyond Compliance program page: program context and panel identities. Sergio Ceniza’s title is FVP, as shown in the official listing and supplied poster.
• ICD — official website: services, programs and contact details. About ICD: institutional identity and mission.
• SEC — official management roster: Commissioner Rogelio V. Quevedo.
• Event date, time, online platform, moderator and event-time affiliations: the original ICD/GGAPP posters reproduced above.

Industry examples are presented as the speakers’ governance illustrations, not as independent findings about the companies named. Compensation disclosure comments summarize the panel discussion; consult the applicable official framework for current obligations and scoring criteria.

Explore more NextEVENTS features, read Thoughts by Sir Next, or discover AI & Digital Transformation.

What did you think?

React anonymously. No sign-in needed.

👍 Like —❤️ Love —💡 Insightful —

Loading reactions…

Share on FacebookCopy link